An issue was discovered in atftpd in atftp 0.7.1. It does not lock the thread_list_mutex mutex before assigning the current thread data structure. As a result, the daemon is vulnerable to a denial of service attack due to a NULL pointer dereference. If thread_data is NULL when assigned to current, and modified by another thread before a certain tftpd_list.c check, there is a crash when dereferencing current->next.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4643-1 advisory.

  - An issue was discovered in atftpd in atftp 0.7.1. A remote attacker may send a crafted packet triggering a     stack-based buffer overflow due to an insecurely implemented strncpy call. The vulnerability is triggered     by sending an error packet of 3 bytes or fewer. There are multiple instances of this vulnerable strncpy     pattern within the code base, specifically within tftpd_file.c, tftp_file.c, tftpd_mtftp.c, and     tftp_mtftp.c. (CVE-2019-11365)

  - An issue was discovered in atftpd in atftp 0.7.1. It does not lock the thread_list_mutex mutex before     assigning the current thread data structure. As a result, the daemon is vulnerable to a denial of service     attack due to a NULL pointer dereference. If thread_data is NULL when assigned to current, and modified by     another thread before a certain tftpd_list.c check, there is a crash when dereferencing current->next.
    (CVE-2019-11366)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4540-1 advisory.

  - An issue was discovered in atftpd in atftp 0.7.1. A remote attacker may send a crafted packet triggering a     stack-based buffer overflow due to an insecurely implemented strncpy call. The vulnerability is triggered     by sending an error packet of 3 bytes or fewer. There are multiple instances of this vulnerable strncpy     pattern within the code base, specifically within tftpd_file.c, tftp_file.c, tftpd_mtftp.c, and     tftp_mtftp.c. (CVE-2019-11365)

  - An issue was discovered in atftpd in atftp 0.7.1. It does not lock the thread_list_mutex mutex before     assigning the current thread data structure. As a result, the daemon is vulnerable to a denial of service     attack due to a NULL pointer dereference. If thread_data is NULL when assigned to current, and modified by     another thread before a certain tftpd_list.c check, there is a crash when dereferencing current->next.
    (CVE-2019-11366)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the atftp package has been released.

The remote host is affected by the vulnerability described in GLSA-202003-14 (atftp: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in atftp. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could send a specially crafted packet to an atftp       instance, possibly resulting in the execution of arbitrary code with the       privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Denis Andzakovic discovered two vulnerabilities in atftp, the advanced TFTP server which could result in denial of service by sending malformed packets.

For Debian 8 'Jessie', these problems have been fixed in version 0.7.git20120829-1+deb8u1.

We recommend that you upgrade your atftp packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Denis Andzakovic discovered two vulnerabilities in atftp, the advanced TFTP server which could result in denial of service by sending malformed packets.

This update for atftp fixes the following issues :

Security issues fixed :

CVE-2019-11366: Fixed a denial of service caused by a NULL pointer dereference because thread_list_mutex was not locked (bsc#1133145).

CVE-2019-11365: Fixed a buffer overflow which could lead to remote code execution caused by an insecure use of strncpy() (bsc#1133114).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
143242	Ubuntu 16.04 LTS : atftp vulnerabilities (USN-4643-1)	Nessus	Ubuntu Local Security Checks	critical
140787	Ubuntu 18.04 LTS : atftpd vulnerabilities (USN-4540-1)	Nessus	Ubuntu Local Security Checks	critical
138441	Photon OS 1.0: Atftp PHSA-2020-1.0-0306	Nessus	PhotonOS Local Security Checks	critical
138184	Photon OS 2.0: Atftp PHSA-2020-2.0-0257	Nessus	PhotonOS Local Security Checks	critical
134591	GLSA-202003-14 : atftp: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
124778	Debian DLA-1783-1 : atftp security update	Nessus	Debian Local Security Checks	critical
124683	Debian DSA-4438-1 : atftp - security update	Nessus	Debian Local Security Checks	critical
124406	SUSE SLES11 Security Update : atftp (SUSE-SU-2019:14033-1)	Nessus	SuSE Local Security Checks	critical
124405	SUSE SLED12 / SLES12 Security Update : atftp (SUSE-SU-2019:1091-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2019-11366

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical